8 ms·

Same as when I read reports of Russia "attacking" the US, I'm having a hard time believing there was the actual evidence to support the origin of the attack in

• nexuist 8y ago
  As with most things, it's hard to prove what actually happened definitively, but there are clues you can piece together to make a claim within a reasonable degree of probability. Things like what type of binaries were installed, what servers were reached out to, even what commands were run...if you collect enough data, it is possible to see patterns in how certain attackers (like USCC) operate, and if we assume a teenager in her parents' basement doesn't have access to the same tools and procedures as USCC does, then it becomes pretty obvious it wasn't her. To a certain degree, if your server has malware X, and you can identify malware X (or something very similar) as belonging to actor A, and you know actors B, C, and D don't have X in their arsenal, then you can guess with high probability that you were attacked by A. Intelligence is probably the most high stakes guessing game in history, and there are definitely smart people at the top who know that simple IP correlation is not enough to make this claim - but they likely have access to sensitive (confidential) data that further justifies that claim.
  • m0zg 8y ago
    >> doesn't have access to the same tools and procedures as USCC does If she's well connected, she does have access to almost everything that's available, short of something that offers no plausible deniablity because it's custom made for a particular system, like Stuxnet, or something that's full of zero days nobody else knows about yet. And the only thing you can conclude in these two cases is that you're _probably_ dealing with a state-level attacker, but you can't say which state unless there's something to further narrow things down, such as unfettered access to controlled nuclear technology in the case of Stuxnet. Notice also how we are always expected to accept these reports on faith, and no _verifiable_ evidence is ever presented.
    • nexuist 8y ago
      No verifiable evidence is presented because it shows your hand. If you show the enemy what you don't know, they could figure out what you weren't able to find out, and use that to their advantage. If they can trace the evidence back to a particular source, they can crack down on it and prevent future evidence from being collected through that pipeline. At best this means they change their security procedures, at worst it means they murder your spies.
      • m0zg 8y ago
        >> because it shows your hand Then why talk about it at all? I'll tell you why. It's propaganda. Someone is trying to shit into someone else's head.
        • nexuist 8y ago
          It is, indeed, propaganda. But propaganda does not always have to be blatantly wrong - even a broken clock is right twice a day, etc.
  • marcosdumay 8y ago
    > Intelligence is probably the most high stakes guessing game in history Nope. Propaganda has higher stakes.
    • pas 8y ago
      What's the guessing in propaganda? It's the complete opposite of sophisticated targeted attacks, basically propaganda is an iterative brute force.
      • espeed 8y ago
        Case and point. Most have no idea how sophisticated propaganda can be. At the highest levels, it washes over you without a trace. The PR industry has been perfecting it for 100 years. You'll never see it.
• jstarfish 8y ago
  > I'm just saying that when someone says "this particular attack was definitely from country X" they're usually full of shit. Coming from your average sysadmin that may be true but that's because they have little intel to work with. Some ssh logs implicating China in a brute-force attack, some malware with Cyrillic characters and linguistics, CNC in Iran, operational hours coinciding with a Brazilian workday...attribution is more an art than a science, hence the number of false positives. That said, the government agencies have more metadata and packet tampering capabilities than they let on. When they need to make a point, they don't tip their hand-- evidence is fabricated through parallel reconstruction or we get just vague assertions with no evidence at all. So who knows. At this level the question is less about technical ability and more about how much we trust our respective governments. Ours has certainly lied to us as the pretense for a military campaign before.
  • anticodon 8y ago
    FYI, almost nobody in Russia uses Cyrillic in the programs/scripts. Most people write comments, variable names, even error messages in English. So when I read that some malware was attributed to us because of Cyrillic, for me it's a sure sign of bullshit.
    • vardump 8y ago
      Huh? So a perfect way for a Russian party to hide its tracks is to actually use Cyrillic. No matter which option you pick, you set up yourself to be deceived. In other words, better to just consider character set doesn't convey much information at all.
      • anticodon 8y ago
        I think it's close to impossible to really tell where malware originated. It's a opening another way for US to blame any country arbitrarily. You want to bomb Iran: just say that there were Farsi letters in the malware. Or the first infection happened in Iran. Or some Iranian was in the country where malware was spotted for the first time. It's not possible to prove or deny. And nobody will ever be able to confirm anyway. US can say: "We have experts on Russian malware that said new virus contains a string "Сделано в СССР в помощь Трампу. С 23 февраля!", so Trump is definitely a Russian agent". There's zero logic or proof in this, but with strong propaganda almost everybody will believe it anyway.
• amanaplanacanal 8y ago
  I suspect the US intelligence agencies have enough taps at enough points in the network that they can tell exactly where things are coming from. They aren't just looking at things from the destination system.